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DETAILED ACTION 



This action is in response to Applicants' amendment to the claims (in RCE) filed 
on 02/04/2008. None of the claims 1, 4 and 6-12 have been further amended. 
Claims 1, 4 and 6-12 are now pending in the present application. The examiner's 
response to the applicants' arguments is shown in the section "Response to Arguments" 
near the end of this office action. This Action is made FINAL. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was 
made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall 
not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness 

or nonobviousness. 



This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
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the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

Claims 1, 4 and 6-12 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Wilson et al. (U.S. Patent Publication # 6,714,976 B1) in view of Ditmer et al. 
(U.S. Patent Publication # 6,473,407 B1) and further in view of Black et al. (U.S. 
Patent Publication # 7,143,153 B1). 

Consider claim 1, Wilson et al. show and disclose a method of filtering one or 
more events associated with one or more computer environments for display in a 
performance monitoring system, wherein each of the one or more events is generated 
when a threshold associated with a first parameter is met (Fig. 14, flowchart blocks 322 
and 324 that show and disclose a filtering process for collected event data by 
comparing the data with pre-defined rules, then continuing to process the filtered data 
only; column 18, lines 40-42 that disclose how the events related to business 
transactions are processed by the filtering process described in the flowchart; column 6, 
lines 27-45 that describe a second filtering process for monitoring the performance of 
various computer systems in a network by disclosing that users can select and specify 
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in the configuration plug-in modules which events to monitor by the monitoring agents; 
Abstract; Fig.1 ; column 4, lines 31-50 that show and disclose the monitoring 
environment with a multiplicity of computer environments (server s1 block 20 and server 
s2 block 22 and monitoring agents 30-40); Fig. 13 and column 17, lines 8-14 that show 
and disclose the corresponding set up for business transaction monitoring events; Fig. 
7; column 10, lines 39-48; column 14, lines 2-7 that disclose defining the trigger events 
and collecting diagnostic information for performance monitoring of computer 
environments; Fig. 14; column 18, lines 1-8 that show and disclose the corresponding 
details for business transaction monitoring events), the method comprising the steps of: 
receiving a filter a set of the one or more computer environments (Fig. 1 , EM Console 
block 42 that receives event triggered data from EM agents 30-40; column 6, lines 42- 
45 that disclose the plug-in modules for filtering and capturing the event triggered data 
and sending the captured data to the EM Console; Table in Fig. 1 1 that shows the type 
of data collected including system component 268 as one or more computer 
environments; and 

displaying the filtered one or more events (Fig. 1 , EM Console block 42 and Monitoring 
Station 24; column 4, lines 20-30 and 63-67 that show and disclose monitoring and 
managing of a distributed application, with an application program running on console 
42 that displays event-triggered monitored data at the component and at the enterprise 
level). 

However, Wilson et al. do not explicitly disclose that in response to the receiving 
step, filtering the one or more events using the filter, wherein the filter is received from, 
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and the one or more filtered events are displayed on a single display window; and 
displaying a link from a first set of information related to the filtered one or more events 
being displayed, said link for accessing a second set of information related to the first 
set of information. 

In the same field of endeavor, Ditmer et al. disclose that in response to the 
receiving step, filtering the one or more events using the filter, wherein the filter is 
received from, and the one or more filtered events are displayed on a single display 
window (column 13, lines 28-39 which disclose a method for alarm management from a 
single workstation, including display or print lists of active alarms and define or display 
customized alarm filters to specify which alarms will appear in the alarm presentation). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to provide, in response to the receiving step, a means 
for filtering the one or more events using the filter, wherein the filter is received from, 
and the one or more filtered events are displayed on, a single display window, as taught 
by Ditmer et al., in the method of Wilson et al., so as to provide the users with specific 
events based on filters defined by the users, thereby displaying focused event 
information in a single workstation window. 

However, Wilson et al., as modified by Ditmer et al., do not specifically disclose 
displaying a link from a first set of information related to the filtered one or more events 
being displayed, said link for accessing a second set of information related to the first 
set of information. 
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In the same field of endeavor, Black et al. show and disclose displaying a link 
from a first set of information related to the filtered one or more events being displayed, 
said link for accessing a second set of information related to the first set of information 
(Figs. 7A and 7C that show links both in the form of clickable status buttons 899a-899e 
(Fig. 7A) and as links 899a-899e (Fig. 7C); when one of these links is clicked, the GUI 
of Fig. 7B is displayed, providing additional details of the filtered event; column 37, lines 
19-35 and 48-55 disclose the same details). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to disclose displaying a link from a first set of 
information related to the filtered one or more events being displayed, said link for 
accessing a second set of information related to the first set of information, as taught by 
Black et al. in the method of Wilson et al., as modified by Ditmer et al., so as to provide 
the network administrator additional status information for one or more filtered events, 
whenever the administrator wishes to further monitor an event that may be of critical 
importance by clicking on the link. 

Consider claim 4, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further show and disclose a method wherein for each of 
the filtered one or more events, the displaying step further comprises the step of 
displaying a first set of information associated with an event identifier (Fig. 1 1 , 
Exception ID column 262; column 13, lines 64-66 that disclose an event identifier field 
262); 
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the associated one or more computer environments (Fig. 1 1 , Components Type field in 
column 266; column 14, lines 7-10 that describe the data item associated with column 
266 of the table in Fig. 11); 

the first parameter (Fig. 1 1 , System Components for Data Gathering column 268; 
column 14, lines 16-34 that describe the data item associated with column 268 of the 
table in Fig. 11); 

the second parameter (Fig. 1 1 , Threshold column 264; column 13, lines 66-67 and 
column 14, lines 1-7 that describe the data item associated with column 264 of the table 
in Fig. 11); and 

a second parameter identifier (Fig. 1 1 , Data ID field of column 266; column 14, lines 7- 
1 5 that describe the data item associated with column 266 of the table in Fig. 11 ). 

Consider claim 6, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method wherein the second set of 
information comprises information associated with the configuration of the one or more 
computer environments (column 15, lines 13-15 which disclose that the data contained 
in table 260 of Fig. 11 (first set of information) is associated with the configuration 
information (second set of information) of the computer system being monitored). 

Consider claim 7, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method wherein the second set of 
information comprises information associated with the threshold (column 13, lines 64-67 
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and column 14, lines 1-7 which disclose that the second set of information (column 264 
of Fig. 1 1) comprises information associated with the threshold). 

Consider claim 8, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose the claimed invention including 
disclosing that the first parameter represents a severity level (in Ditmer et al. reference, 
column 20, line 46 that discloses different levels of severity for monitoring events). 

Consider claim 9, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method comprising the steps of: 
receiving a second filter representing at least one second parameter (in Ditmer et al. 
reference, Fig. 9, column 20, lines 35-67 and column 21, lines 1-35 which disclose that 
a customer typically subscribes to several services; therefore, in order to limit data 
collection to data germane to those particular services, the user must specify which 
services (e.g. VNET in the SQL statement shown in column 21, lines 9-18) need to be 
monitored, thereby disclosing receiving a second filter representing at least one second 
parameter), 

filtering the one or more events using the second filter in response to receiving the 
second filter (the SQL statement shown in column 21 , lines 9-18, which acts as a filter 
to limit the monitored events only to the services subscribed by the customer), 
wherein the second parameter represents a resource (in Ditmer et al. reference, the 
services subscribed represent monitoring corresponding resources for any events). 
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Consider claim 10, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method further comprising the steps 
of: 

receiving a second filter representing at least one second parameter (in Ditmer et al. 
reference, column 21, lines 52-58 which disclose that events identified in the event view 
(defined by the user) may be periodically forwarded based upon a customer 
configurable interval, thereby disclosing receiving a second filter representing at least 
one second parameter (period or time interval for which the generated events are to be 
displayed in the user view)), 

filtering the one or more events using the second filter in response to receiving the 
second filter (in Ditmer et al. reference, column 21, lines 52-58 which further disclose 
that only the events generated during the specified time interval (second filter) are made 
available in an event queue for display to the user in order of the severity of the event), 
wherein the second parameter represents a time (in Ditmer et al. reference, column 21 , 
lines 52-58 which disclose that events identified in the event view (defined by the user) 
may be periodically forwarded based upon a customer configurable interval, thereby 
disclosing that the second parameter represents a time). 

Consider claim 11, and as applied to claim 1 above, Wilson et al., as modified 
by Ditmer et al. and Black et al., further disclose a method wherein each of the one or 
more computer environments comprises at least one computer system (in Wilson et al. 
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reference, Fig. 1 , server s1 block 20 and server s2 block 22 as examples of one or more 
computer environments with at least one computer system; column 4, lines 20-30 that 
disclose various components of the invention). 

Consider claim 12, Wilson et al. clearly disclose an apparatus for filtering one or 
more events associated with one or more computer environments for display in a 
performance monitoring system, wherein each of the one or more events is generated 
when a threshold associated with a first parameter is met (Fig. 14, flowchart blocks 322 
and 324 that show and disclose a filtering process for collected event data by 
comparing the data with pre-defined rules, then continuing to process the filtered data 
only; column 18, lines 40-42 that disclose how the events related to business 
transactions are processed by the filtering process described in the flowchart; column 6, 
lines 27-45 that describe a second filtering process for monitoring the performance of 
various computer systems in a network by disclosing that users can select and specify 
in the configuration plug-in modules which events to monitor by the monitoring agents; 
Abstract; Fig.1; column 4, lines 31-50 that show and disclose a monitoring apparatus 
with a multiplicity of computer environments (server s1 block 20 and server s2 block 22 
and monitoring agents 30-40); Fig. 13 and column 17, lines 1-8 show and disclose the 
corresponding set up for business transaction monitoring events; Fig. 7; column 10, 
lines 39-48; column 14, lines 2-7 that disclose defining the trigger events and collecting 
diagnostic information for performance monitoring of computer environments; Fig. 14; 
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column 18, lines 1-8 that show and disclose the corresponding details for business 
transaction monitoring events), the apparatus comprising: 
means for receiving a filter representing a set of the one or more computer 
environments (Fig. 1 , EM Console block 42 that receives event triggered data from EM 
agents 30-40; column 6, lines 42-45 that disclose the plug-in modules for filtering and 
capturing the event triggered data and sending the captured data to the EM Console; 
Table in Fig. 1 1 that shows the type of data collected including system component 268 
as one or more computer environments); and 

means for displaying the filtered one or more events (Fig. 1 , EM Console block 42 and 
Monitoring Station 24; column 4, lines 20-30 and 63-67 that show and disclose the 
means for monitoring and managing a distributed application, with an application 
program running on console 42 that displays event-triggered monitored data at the 
component and at the enterprise level). 

However, Wilson et al. do not specifically disclose means, responsive to the 
receiving means, for filtering the one or more events using the filter; wherein the filter is 
received from, and the one or more filtered events are displayed on, a single display 
window; and means for displaying a link from a first set of information related to the 
filtered one or more events being displayed, said link for accessing a second set of 
information related to the first set of information. 

In the same field of endeavor, Ditmer et al. disclose means, responsive to the 
receiving means, for filtering the one or more events using the filter, wherein the filter is 
received from, and the one or more filtered events are displayed on, a single display 
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window (column 13, lines 28-39 which disclose a means for alarm management from a 
single workstation, including displaying or printing lists of active alarms and defining or 
displaying customized alarm filters to specify which alarms will appear in the alarm 
presentation). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to provide, means, responsive to the receiving means, 
for filtering the one or more events using the filter, wherein the filter is received from, 
and the one or more filtered events are displayed on a single display window, as taught 
by Ditmer et al., in the apparatus of Wilson et al., so as to provide the users with specific 
events based on filters defined by the users, thereby displaying focused event 
information in a single workstation window. 

However, Wilson et al., as modified by Ditmer et al., do not specifically disclose 
displaying a link from a first set of information related to the filtered one or more events 
being displayed, said link for accessing a second set of information related to the first 
set of information. 

In the same field of endeavor, Black et al. show and disclose displaying a link 
from a first set of information related to the filtered one or more events being displayed, 
said link for accessing a second set of information related to the first set of information 
(Figs. 7A and 7C that show links both in the form of clickable status buttons 899a-899e 
(Fig. 7A) and as links 899a-899e (Fig. 7C); when one of these links is clicked, the GUI 
of Fig. 7B is displayed, providing additional details of the filtered event; column 37, lines 
19-35 and 48-55 disclose the same details). 
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Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to disclose displaying a link from a first set of 
information related to the filtered one or more events being displayed, said link for 
accessing a second set of information related to the first set of information, as taught by 
Black et al. in the method of Wilson et al., as modified by Ditmer et al., so as to provide 
the network administrator additional status information for one or more filtered events, 
whenever the administrator wishes to further monitor an event that may be of critical 
importance by clicking on the link. 

Response to Arguments 

Applicant's arguments filed 02/04/2008 have been fully considered but they are 
not persuasive. The examiner's response to the arguments is presented below: 

Consider claim 1. Applicants argue that the cited paragraph at column 6, lines 
42-45 is silent as to the filter representing a computer environment. The examiner has 
interpreted the text of the paragraph "This allows the detection code to act as plug-in 
modules that the user can select for configuring which events are to be monitored" to 
mean that the plug-in modules correspond to options processing code for a drop-down 
list-box of a GUI in a windows environment. When a user selects a specific plug-in 
module, the action is equivalent to making a selection from a drop-down list of a list-box 
(same as a filter); the selection resulting in monitoring the event data from one or more 
event agents 30-40 (shown in Fig. 1), each of which monitors events in a specific 
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computer environment shown as environments 12-22 in Fig. 1; Fig. 3, Column 7, lines 
32-35 show and disclose module 80 that can filter the traffic relevant to agent 50. 

Furthermore, the applicants argue that the cited teachings of Ditmer et al. 
reference (U.S. Patent Publication # 6,473,407 B1) refers to "a single workstation" 
which is not comparable to the single display window, as claimed. The examiner begs 
to differ. A single workstation is certainly providing a single display window. 

The applicants also argue that Ditmer et al. reference does not teach filtering 
events (which are associated with one or more computer environments) based upon a 
filter representing a set of the one or more environments as claimed. As explained 
above, this element of claim 1 is taught by Wilson et al. reference (U.S. Patent 
Publication # 6,714,976 B1 ). One cannot show nonobviousness by attacking 
references individually where the rejections are based on combinations of references. 
See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 
F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). Yet, the Ditmer et al. reference also 
discloses the filtering of events based on alarms, which are raised when certain events 
cross the specified thresholds. The examiner does not agree with the applicants' 
assertion that the type of filter taught by Ditmer et al. is different than that claimed. As 
disclosed in column 13, lines 21-27 of the Ditmer et al. reference, the described Event 
Monitor enables monitoring of voice and data circuits that correspond to computer 
environments. The examiner therefore asserts that the cited references do adequately 
disclose all the claimed elements of claiml . 
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Finally the applicants' argument that the motivation to combine the cited 
references does not necessarily result from the proposed combination; the examiner 
needed the combination with Ditmer et al. only to show "a single display window" 
feature of claim 1 . The Wilson et al. reference, although implied this feature, did not 
specifically mention it. So, the examiner used the Ditmer et al. reference that clearly 
states using a single workstation. 

The examiner has responded to applicants' presented arguments, and still 
considers that the cited references adequately disclose all the elements of the 
independent method claim 1 and corresponding apparatus claim 12, which are 
therefore deemed not allowable. The corresponding dependent claims 4 and 6-11 
are also rejected based on their dependency on claim 1 . 

Conclusion 

THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded 
of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
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the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any response to this Office Action should be faxed to (571) 273-8300 or mailed 

to: 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Art Unit: 2143 

Hand-delivered responses should be brought to 

Customer Service Window 
Randolph Building 
401 Dulany Street 
Alexandria, VA 22314 

Any inquiry concerning this communication or earlier communications from the 
Examiner should be directed to Kishin G. Belani whose telephone number is (571) 270- 
1768. The Examiner can normally be reached on Monday-Thursday from 6:30 am to 
5:00 pm. 

If attempts to reach the Examiner by telephone are unsuccessful, the Examiner's 
supervisor, Nathan Flynn can be reached on (571) 272-1915. The fax phone number for 
the organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
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information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free) or 703-305-3028. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist/customer service whose telephone 
number is (571)272-0800. 

Kishin G. Belani 
K.G.B./kgb 
April 22, 2008 



/Kenny S Lin/ 

Primary Examiner, Art Unit 2152 



